🛡️ Your Computer Got Infected — Now What? A Developer's Survival Guide to Malware Removal

A practical, no-BS walkthrough of detecting, containing, and eliminating malware — with real scenarios and the commands that actually work.

So it happened. Your machine is acting weird. Maybe Chrome is opening tabs you didn't ask for. Maybe your CPU is pegged at 95% doing... nothing. Maybe your antivirus just screamed at you. Whatever it is, that sinking feeling in your stomach is valid — but panic won't help. A methodical approach will.

This guide walks you through exactly what to do when your system is compromised, from initial triage to full recovery. I'll use real-world malware scenarios so you can match your situation to the right fix.

🚨 First: Know the Signs of Infection

Before we dive into removal, let's confirm we're actually dealing with malware and not a failing hard drive or a runaway Chrome extension.

Common infection symptoms:

• Browser homepage changed without your input
• Sluggish performance with abnormally high CPU/RAM/network usage
• New toolbars, extensions, or programs you didn't install
• Antivirus disabled or greyed out
• Ransom notes appearing on your desktop (yes, really)
• Your contacts receiving emails/DMs you never sent
• System logs showing processes connecting to unknown IPs

If two or more of these apply to you — keep reading. You've got a problem.

🔬 Step 1: Don't Touch Anything Yet — Observe First

Scenario: You notice your system fan is running full blast at 2 AM while your computer is idle. You check Task Manager and see a process called svchost32.exe consuming 80% CPU.

🔴 Red flag: Legitimate Windows processes don't have numbers in their name like that. svchost.exe is real; svchost32.exe is almost certainly a cryptominer or trojan.

What to do:

Before you start killing processes or running scans, document what you're seeing. Take screenshots. Note the process names, PIDs, and any network connections.

On Windows (PowerShell, run as Admin):

# List all running processes with their full file paths
Get-Process | Select-Object Name, Id, Path | Sort-Object Name | Format-Table -AutoSize

# Check network connections and which process owns them
netstat -b -n -o

# See scheduled tasks (a favorite malware persistence trick)
Get-ScheduledTask | Where-Object {$_.State -ne "Disabled"} | Select-Object TaskName, TaskPath

On macOS/Linux (Terminal):

# Full process list with CPU usage
ps aux --sort=-%cpu | head -20

# Active network connections
sudo lsof -i -n -P | grep ESTABLISHED

# Cron jobs (persistence mechanism)
crontab -l
cat /etc/cron* 2>/dev/null

🔌 Step 2: Isolate the Machine — Cut the Network

Scenario: You ran the netstat command above and see your machine making outbound connections to an IP in a country you've never visited. The process is update_helper.exe — which you've never heard of.

This is classic C2 (Command & Control) communication — your machine is "phoning home" to a remote attacker who may be exfiltrating your data right now.

Act immediately:

1. Disconnect from Wi-Fi — turn off the Wi-Fi adapter, don't just click disconnect
2. Unplug the ethernet cable if wired
3. Do NOT shut down yet — live memory may contain forensic evidence (encryption keys, attacker IPs, etc.) you'll want if this is a serious breach
4. On Windows: Disable the NIC via Device Manager to be certain

# Disable a specific network adapter (replace "Ethernet" with your adapter name)
Disable-NetAdapter -Name "Ethernet" -Confirm:$false
Disable-NetAdapter -Name "Wi-Fi" -Confirm:$false

💾 Step 3: Back Up — But Be Careful What You Back Up

Scenario: You have a ransomware infection (you'll know because your files now have extensions like .locked, .encrypted, or .ryuk and there's a README_DECRYPT.txt on your desktop).

⚠️ Critical warning: Do NOT back up encrypted files as your only copy. Do NOT pay the ransom until you've checked for free decryptors (more on this later).

What to back up NOW (before any cleanup):

• Uninfected documents, photos, and project files (check that they open correctly)
• Browser bookmarks (export them manually)
• SSH keys, .env files, API credentials — rotate these immediately after
• Any database dumps or code repositories not already on GitHub/GitLab

What NOT to back up:

• Executable files (.exe, .bat, .ps1, .sh) from your system — they may be infected
• Your system restore points (may be compromised)
• Browser extension data (could carry adware)

Use an external drive or a clean cloud upload — not another partition on the same disk.

🧹 Step 4: Boot into Safe Mode and Run Your Scans

Most malware is clever enough to defend itself while the OS is running normally — it hides its processes and blocks antivirus updates. Safe Mode loads the bare minimum, making the malware easier to kill.

Boot into Safe Mode with Networking:

• Windows 10/11: Hold Shift → click Restart → Troubleshoot → Advanced Options → Startup Settings → Restart → Press F5
• macOS: Hold Shift during startup (Apple Silicon: hold power button → select startup disk → hold Shift → Continue in Safe Mode)
• Linux: At GRUB menu, select recovery mode or add single to kernel boot parameters

Now run these — in this order:

4a. Malwarebytes (Free Tier is sufficient)

Download from a clean device if needed. Malwarebytes is excellent at catching PUPs (Potentially Unwanted Programs), adware, trojans, and rootkits that traditional AV misses.

# After install, run a Threat Scan — it targets the most common infection locations:
# - Running processes
# - Startup entries  
# - Registry keys
# - File system hotspots (%AppData%, %Temp%, %ProgramData%)

4b. Windows Defender Offline Scan (Windows only)

This runs before Windows loads, catching bootkits and rootkits that hide at the OS level:

# Run this from PowerShell as Admin — it will schedule a pre-boot scan
Start-MpWDOScan

4c. RKill (Windows) — Kill Malicious Processes First

If your scanner keeps getting blocked or your AV won't open, use RKill from BleepingComputer to terminate known malicious processes before scanning:

# Run rkill.exe as Administrator
# It will generate a log of everything it killed — save this for later

🔍 Step 5: Manual Investigation — Go Deeper

Automated scanners miss things. Here's how developers should manually investigate.

Check Startup Entries

Scenario: Your browser keeps opening a casino website every time Windows starts, even after you've reset your homepage.

# Windows: Check all autorun locations
# Sysinternals Autoruns is the gold standard — download it from Microsoft
autoruns.exe  # Run as Admin, look for entries highlighted in red or yellow

# Via PowerShell:
Get-CimInstance -Class Win32_StartupCommand | Select-Object Name, Command, Location

# macOS — LaunchAgents are a common persistence location
ls -la ~/Library/LaunchAgents/
ls -la /Library/LaunchAgents/
ls -la /Library/LaunchDaemons/

# Linux — systemd services
systemctl list-units --type=service --state=running
ls /etc/systemd/system/

Inspect the Hosts File

Malware often hijacks your hosts file to redirect legitimate sites (like your bank) to phishing clones.

# Windows
notepad C:\Windows\System32\drivers\etc\hosts

# macOS/Linux
cat /etc/hosts

A clean hosts file should only have 127.0.0.1 localhost and ::1 localhost entries. Anything pointing to external IPs is suspicious.

Check Browser Extensions

Scenario: Your colleague clicked a "free PDF converter" Chrome extension and now everyone in the office is seeing ads injected into every website.

Chrome:  chrome://extensions/
Firefox: about:addons
Edge:    edge://extensions/

Remove anything you don't recognize or haven't intentionally installed. Even legitimate-looking extensions (e.g., "Grammar Checker Pro") can be malicious if they were silently installed.

🔐 Step 6: Ransomware — Specific Response Plan

Ransomware deserves its own section because the response is different.

Before paying anything:

1. Identify the ransomware strain — upload the ransom note and a sample encrypted file to ID Ransomware
2. Check for free decryptors at NoMoreRansom.org — law enforcement has cracked keys for dozens of strains including Ryuk, WannaCry variants, and Dharma
3. Preserve the encrypted files — even if there's no decryptor today, one may exist in 6 months
4. Report to authorities — in the US: IC3.gov, in the EU: your national CERT

If you have Volume Shadow Copies enabled (Windows):

# Check if shadow copies exist (ransomware often deletes these — check anyway)
vssadmin list shadows

# If they exist, you can restore individual files via:
# Right-click file → Properties → Previous Versions tab

🔄 Step 7: Remove and Remediate

Once you've identified the malware, it's time to remove it cleanly.

Registry Cleanup (Windows)

# Always back up the registry before editing
reg export HKLM\SOFTWARE backup_HKLM_SOFTWARE.reg

# Common malware persistence locations to inspect:
# HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
# HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
# HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

regedit  # Navigate manually and delete suspicious entries

Reset DNS Settings

Malware often changes your DNS to a rogue server that intercepts your traffic.

# Windows — reset DNS to automatic (DHCP)
netsh interface ip set dns "Ethernet" dhcp
netsh interface ip set dns "Wi-Fi" dhcp
ipconfig /flushdns

# Or set to a trusted public DNS
netsh interface ip set dns "Wi-Fi" static 1.1.1.1  # Cloudflare

# macOS
networksetup -setdnsservers Wi-Fi 1.1.1.1 8.8.8.8

# Linux
echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf

Reset Browser Settings

Chrome: Settings → Reset and clean up → Restore settings to original defaults
Firefox: Help → More Troubleshooting Information → Refresh Firefox

🧱 Step 8: Rebuild Trust — Rotate Everything

Scenario: You found a keylogger on your machine. It's been running for 3 weeks.

Assume every password you typed is compromised. Assume every SSH session you opened is compromised. Act accordingly.

Immediate credential rotation checklist:

• [ ] Change your email password (from a clean device first)
• [ ] Enable 2FA on all accounts if not already on
• [ ] Rotate all SSH keys: ssh-keygen -t ed25519 -C "post-incident-$(date +%Y%m%d)"
• [ ] Revoke and regenerate all API keys (AWS, GitHub, Stripe, etc.)
• [ ] Rotate database credentials and connection strings
• [ ] Invalidate all active sessions (GitHub: Settings → Sessions → Revoke all)
• [ ] Check your GitHub/GitLab for any unauthorized commits or OAuth apps
• [ ] Notify your team if you share any services

✅ Step 9: Verify and Harden

You've cleaned up. Now let's make sure it doesn't happen again.

Verify the Cleanup

# Run a final Malwarebytes scan
# Run Windows Defender Full Scan
# Recheck netstat for unexpected connections
netstat -b -n | findstr ESTABLISHED

# Verify no new scheduled tasks appeared
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)}

Harden Going Forward

# Windows: Enable Controlled Folder Access (blocks ransomware from encrypting your files)
Set-MpPreference -EnableControlledFolderAccess Enabled

# Enable audit logging
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable

# Linux: Install and configure fail2ban
sudo apt install fail2ban
sudo systemctl enable fail2ban

# Enable automatic security updates
sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades

Universal hardening tips:

• Use a password manager — stop reusing passwords
• Keep your OS and apps updated (most infections exploit known, patched vulnerabilities)
• Use a standard (non-admin) user account for daily use
• Enable full-disk encryption: BitLocker (Windows), FileVault (macOS), LUKS (Linux)
• Run a DNS-level blocker like Pi-hole or use NextDNS to block malicious domains before they load

🧨 Nuclear Option: When to Just Reinstall

Sometimes the malware is too deeply embedded — rootkits that survive OS reinstalls by hiding in the bootloader or firmware, for instance. Here's when to wipe and start fresh:

• You found a bootkit or UEFI malware (rare, but it exists — tools like chkrootkit or rkhunter on Linux can detect these)
• The infection is more than a few weeks old and you can't determine the full scope
• You found a Remote Access Trojan (RAT) — assume total compromise
• You're a high-value target (developer with production access, finance, healthcare) and you can't be 100% certain of a clean state

# If reinstalling Windows, use the "Remove everything" option with "Remove files and clean the drive"
# This does multiple overwrite passes — more thorough than a quick format

# On Linux, reinstall from a verified ISO (check the SHA256 hash)
sha256sum ubuntu-24.04-desktop-amd64.iso
# Compare against the hash published on ubuntu.com

📋 Quick Reference: Incident Response Checklist

DETECT
  [ ] Identify symptoms
  [ ] Document process names, PIDs, network connections

CONTAIN  
  [ ] Disconnect from network
  [ ] Do NOT shut down (preserve forensics)
  [ ] Photograph/screenshot everything

COLLECT
  [ ] Back up clean data to external drive
  [ ] Export browser bookmarks
  [ ] Note all installed software

ANALYZE
  [ ] Boot into Safe Mode
  [ ] Run Malwarebytes + Windows Defender Offline
  [ ] Check startup entries, hosts file, browser extensions
  [ ] Identify malware strain (ID Ransomware for ransomware)

REMOVE
  [ ] Delete malicious files/registry entries
  [ ] Remove suspicious extensions and software
  [ ] Reset DNS, reset browser settings

RECOVER
  [ ] Rotate all credentials from a clean device
  [ ] Revoke SSH keys, API keys, OAuth tokens
  [ ] Notify team if shared services were affected
  [ ] Report to authorities if data was exfiltrated

HARDEN
  [ ] Enable full-disk encryption
  [ ] Enable Controlled Folder Access / equivalent
  [ ] Set up automatic OS updates
  [ ] Deploy DNS-level filtering
  [ ] Review and tighten user privileges

🧠 Final Thoughts

Getting hit with malware is frustrating, but it's survivable if you stay calm and methodical. The biggest mistakes people make are:

1. Panicking and shutting down immediately — you lose volatile forensic data
2. Trusting a single scanner — layer your tools
3. Stopping at "virus removed" — the malware got in somehow; find and close that door
4. Skipping credential rotation — this is how one infection turns into an account takeover six weeks later

The developers who handle incidents best treat them like debugging sessions: gather data, form a hypothesis, test it, repeat. Your machine is just another system to troubleshoot — and you're good at troubleshooting.

Stay safe out there. 🔐

Have a specific malware scenario that isn't covered here? Drop it in the comments — I read everything.

Tags: #security #cybersecurity #tutorial #devops